Government
Cybersecurity
Status Report
4 Important Ways to Take Action
and Drive Change in 2023

Part of Ivanti’s Cybersecurity Status Report Series

The Right Time?
Now.
Recent attacks on hospital networks, global
logistics systems and even democraticelections pose a fundamental threat to public
safety and governance.

Governments worldwide have taken notice. New mandates fromPresident Biden, as well as directives from the European Commission,
mark a new state of global urgency to protect critical assets andinfrastructure from cyberattacks.

Ivanti surveyed over 800 government
employees worldwide to understand:Employee behavior and attitudes about cybersecurity

But we are still in early days.
High-speed advances in generative AI and “deepfakes” meanransomware delivery is about to become even more believable– and therefore more dangerous.

The impact of flexible and hybrid work arrangements on
the public sector

Cybersecurity professionals’ take on emerging threats andsecurity technology

Government Cybersecurity Status Report2Why the all-out
urgency?

It’s not only the new modes of attack and high-profile government directives. The very nature of work inside government
agencies has changed dramatically in just a few years — without any of the advance planning that would typically precedesuch a drastic shift. Hybrid working has opened up yet another frontier of vulnerability.

New reality

New risks

70% of government employees are working virtually at least some of the time

A proliferation of devices, users
and locations adds complexity
and new vulnerabilities

Q:

Which of these answers best describes the way people with desk jobs at yourorganization work?

of security professionals
Global

30%

20%

US

31%

19%

29%

Australia
UK

20%

Germany

20%

32%
22%

30%

0%

20%
Fully in office

23%

13%

52%
40%
Mostly in office60%
Evenly split

10%
25%

29%

4%
8%

36%

44%
12%

19%

22%
17%

FranceNetherlands

13%

47%

worldwide say they don’t
have high visibility into every
user, device, application andservice on their networks.

3%
8%

45%

5%

28%

5%

19%

3%

80%

100%

Mostly Virtual

Fully Virtual34%of government workers
surveyed use the same orsimilar passwords acrossmultiple devices.

*Country results may not add to 100% due to rounding errors

Government Cybersecurity Status Report3Inside:Methodology
Ivanti surveyed over 6,500 executive leaders, cybersecurity01

No Culture of Accountability

professionals and office workers in Q4-2022 to understand
today’s threats and discover how organizations are preparing
for yet-unknown future threats, as originally published in
Press Reset: A 2023 Cybersecurity Status Report.

02

Password (Mis)management:
Security’s “Ground Zero”

Insights collected here are based on responses from asubset of that study: office workers working in government
around the globe (803 total), as well as cybersecurity

03

Training for All:
Government’s Human-Sized
Cybersecurity Gaps

professionals from multiple industries.

Surveyed government employees (n=803)
Netherlands

04

Futureproofing Government
Organizations

13%

UK

17%

China

3%

Germany

11%

FranceUS

17%This document is provided strictly as a guide. No guarantees can be provided or
expected. This document contains the confidential information and/or proprietaryproperty of Ivanti, Inc. and its affiliates (referred to collectively as “Ivanti”) and may
not be disclosed or copied without prior written consent of Ivanti.
Ivanti retains the right to make changes to this document or related productspecifications and descriptions, at any time, without notice. Ivanti makes nowarranty for the use of this document and assumes no responsibility for any errorsthat can appear in the document, nor does it make a commitment to update theinformation contained herein. For the most current product information, please
visit ivanti.com

16%

Japan

5%

India

4%

Australia

14%
Government Cybersecurity Status Report4

01

No “Culture of Accountability”

Do employees think their own actions matter?

Problem Today

A “not my job” attitude
compromises government
cybersecurity

Q:

Do you believe your actions impact yourorganization’s ability to stay safe from cyberattacks?

60%

53%
Employee disengagement is a real security risk fororganizations. Engagement and satisfaction scores in the

50%

44%

public sector lag behind those of private sector employees by
15 points, according to the Partnership for Public Service.1

40%

And low engagement means employees don’t feel connected

41%

34%

or accountable to the wellbeing of the larger organization.
Ivanti’s research data bears this out: A large share of

30%

25%

government employees around the world think their actions
don’t matter when it comes to security.

27%

19%

20%

In the UK, 27% of government employees say their actions
don’t impact their organization’s ability to stay safe fromcyberattacks; in Germany, the ratio rises to 53%.

10%

0%

GlobalUS

Australia

UK

Germany

FranceNetherlands“My actions do not impact my organization’s ability to stay safe from cyberattacks.”

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

6Not all government workers reportsuspicious activity

17%

Government workers get phished– a prelude to cyberattacks

don’t feel safe reporting a security
mistake they’ve made at work to thecybersecurity team.

30%
say they’ve been a targetof phishing.

36%

did not report a phishing email theyreceived at work.

5%
21%

have fallen victim to a phishingattempt — either by clicking a linkor sending money.

say they don’t care if their organization
gets hacked.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

7

Multiple, effective threat vectors

Why It Matters

The public sector is particularly vulnerable to attack due to the size and value ofA perfect cybersecurity
storm approaches
every governmentorganization

the target. In the last year, hackers from state-sponsored persistent threats such as
APT29 have all proved formidable, fast-evolving foes.2

Fast-evolving “synthetic” digital content
Generative AI has made phishing emails “picture perfect” — personalized to thevulnerabilities of each individual target.3
Even more alarming: Deepfakes pose a threat to the credibility of journalism anddemocratic elections worldwide.4

Budget constraints and organizational silos
weaken security efforts
The US Government Accountability Office (GAO) says 60% of its cybersecurity
recommendations have not been implemented over the last decade.5

A significant share of disengaged
employees
The average US federal employee engagement stands at 64.5 out of 100 — 14 points

72%

behind the private sector.6of government employees havenever contacted security to ask
a question or voice a concern.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government8

Take Action

Make security a shared
responsibility with all employees
Security leaders can’t compel employees to care aboutcybersecurity, but they can influence employee attitudes overtime by investing in and nurturing a positive security culture.

What makes apositive security
culture?

Open
Employees feel comfortable asking

Integrated
Security accountability is shared;
every last employee has a role to play

the security team questions

Safe

Iterative
Training is frequent, iterative

Employees feel safe

and compelling

reporting incidents or errors

Strategic
Security is an asset — a key tothe organization’s successGovernment Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

9

Next Steps

Audit, involve and optimize youremployees’ experiences for apositive security culture

1

Audit
Survey employees to define your baseline and document
current behaviors and attitudes. The findings will help
identify your organization’s specific weaknesses andinform a practical roadmap for change.

2

Involve
Engage with organizational leadership to get their support
and buy-in. Leaders not only set the tone, but they also
represent one of your biggest areas of risk.
Read more about leaders’ risk to cybersecurity on page 19(“Whalephishing 101 in government organizations”).

3

Optimize
Culture change is never “one and done.” It’s an ongoingprocess that requires monitoring key performance metrics,
listening to employees and making course corrections
when needed.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

10

02

Password (Mis)management:
Security’s “Ground Zero”

Government password access misdeeds

Problem Today

Poor cyber hygiene —including bad password
habits — haunts
government agencies

12%

1 in 3of government employees admit to

say they believe their passwords at

Security experts have been sounding the alarm on password

accessing sensitive information theyold jobs still work.

risk for more than a decade, but most organizations —didn’t require for their job duties.

including government agencies — may still take a lax approach
to password management. Ivanti’s research uncovered a wide
range of bad habits from our government respondents.

Percentage of government employees who use
the same work password for longer than a year
47%
40%
32%

GlobalUS

35%

Australia

41%
35%

UK

Germany

33%

FranceNetherlands

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government12

Why It Matters

The push and pullof security versus
convenience

The myth of “digital natives”
Think your younger employees are more savvy about password security?
The data doesn’t back it up.

When you’re asked to create a login password at work,
which of these things have you done within the last two years?

Q:

So-called “shadow IT” and other workarounds are theenemy of secure organizations. When employees finda security measure inefficient or burdensome, they’llfind a way around it that is decidedly not secure.

48%

Gen Z
(b. 1995-2012*)

Passwords are ground zero for employee security
workarounds. Employees in all industries continue

35%
40%

Millennials(b. 1981-1997)

to use sticky notes, pet names, birthdays and theuniversally favorite unbreakable code: “12345.”
Government organizations need security solutions thatare so convenient — so effortless — that employees

26%
31%

Gen X
(b. 1965-1980)

16%

don’t seek ways around the so-called solution.

22%

Boomers(b. < 1965)

8%
0%

10%

20%

30%

40%

50%

Use same/similar passwords on multiple devices and logins
Reuse passwords between home and work
* Only those aged 18 or older completed the survey.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

13

Next Steps

Take Action

Invest in digital employee
experience (DEX) for
greater security

Implement user-friendly
experiences while enforcing
security

Security teams should evaluate new policies or technologies
through the lens of digital employee experience, or “DEX,”
asking themselves, “Will the end-user experience encourage
workarounds or other inadvisable behavior for the sake of1

convenience — and if so, is that risk worth it?”Zero in on the high-hazard
workarounds• Employees sidestep security in the nameof convenience• High-profile leaders request exemptions tosecurity rules

2

Prioritize DEX-focusedtechnology• Achieve user-centered experiences(less friction = greater compliance)• Remove human agency when possible• Lock down exemptions

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

14

Real-World Repercussions:

Zero Trust architecture (ZTA) implementations& DEX considerations
Whether using two-factor authentication,
tokens or biometric data, organizations andagencies alike should prioritize – and commit
to – a least-privileged access model for all
employees, following a Zero Trust architecture(ZTA) strategy.
Under ZTA, security and IT solutions work
together to continuously verify security posture

employees) and maintenance (for IT staff),
encouraging use of shadow IT and erasing any

The NIST Cybersecurity Framework (CSF):

benefit of ZTA.

Mapping Ivanti’s Solutions to CSF Controls

Therefore, agencies considering ZTA
should leverage:

access for any given employee as required.

notifications, suspicious behavior alerts

allowing for flexible working arrangements.

(“Zero Trust Architecture”)

cumbersome for day-to-day operations (for• Strategic automation for unknown device

access ensures an agency’s security while

NIST Special Publication 800-207

However, ZTA can prove excessively

and compliance by providing only as much

Among other security benefits, this limited

Additional Resources
for ZTA and DEX

The 2022 Digital Employee Experience Report

Getting Started with DEX: Core Areas of Focus

and user privilege access timeouts.

to Deliver a Great Digital Employee Experience• IT playbooks and decision trees for

permission requests and common queries.

Employee Experience in the Age of the• Intuitive, easily accessed instructions for

After all, if an employee succumbs to a phishingend users to “help themselves” before

attack, then the threat actor can only accesssubmitting an IT ticket.

Everywhere Workplace: Why IT Needs to Leadthe Charge

the limited options available to the employee.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

15

03

Training for All:
Government’s Human-Sized
Cybersecurity Gaps

Training for all? Not even close.

Problem Today

Uneven cybersecurity
training strains
government defenses

Q:“Does your organization provide mandatory cybersecurity training?”

No / Unknown

Yes

Security and automation technologies provide powerfulfrontline protection — but training employees to be yourGlobal39%

61%

company’s security eyes and ears is a critical secondary
defense. Ivanti’s research shows training in the public sector
simply isn’t reaching everyone.

US

22%

Australia

UK

78%

71%

29%

16%

84%

Germany

France

27%

54%

46%

76%

Netherlands

50%

24%

50%

Just 27% of government workers
feel “very prepared” to recognize
and report threats like malware
and phishing at work.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

17

Why It Matters

Government workers
and contractors
report little orineffective training,
despite mandates

32%
of security professionals say ineffective
or incomplete employee training is asignificant barrier to cybersecurity
excellence at their organization.

The 2023 Press Reset global study of security
professionals worldwide found that a significant
share of organizations fall far short in educating
and training employees about cybersecurity risks
and reporting processes.
And it only takes a single person making a single
misstep to cause unintentional but catastrophic
damage — and within government agencies, thatdamage impacts every supported constituent.

29%of organizations worldwide don’t
require partners and/or vendors tocomplete cybersecurity training —an exposed position for government
agencies with third-party contractors.

Insights fromPress Reset: A 2023 Cybersecurity Status Report

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

18

Real-World Repercussions:“Whalephishing 101” for government organizations
Whalephishing involves socially engineered
communications to high-value, high-risk targets,or “whales.” Common whalephishing targets include
division leaders, public figures and finance chiefs– or even their assistants or administrative personnel

Leadership-level employees are more likely to practiceunsafe security behaviors than other workers

within a desirable division.
By tricking the target into believing theMore than 1 in 3 leaders have clicked on

Nearly 1 in 4 leaders use

a phishing link — four times the rate ofeasy-to-remember birthdays

the average office employee!

as part of their passwords.

And research shows that the very people with theLeaders are much more likely to hang

Leaders are five times more likely

highest levels of access to sensitive information

on to passwords for years than otherto share their passwords with people

and networks frequently exhibit the poorest

workers – in fact, 1 in every 4 surveyed

outside the company.

security habits.

leaders do so.

communication is genuine, threat actors can then gaincredentials, sensitive information or even fraudulent
wire transfer authorizations.
Such access is often undetected and unreported
for extended periods of time, allowing advanced
persistent threats (APTs) to lurk within government
networks for months… or even years.7*These statistics apply to leaders across industries, including the public sector,
as drawn from Press Reset: A 2023 Cybersecurity Status Report.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

19

Take Action

Enforcing training acrossall government employees
lowers security risks while
improving attitudes

One of the best ways to reach sensitive information accessible by“whales” (or any privileged user) can be through the employees who

The best security training delivers both...

work alongside them:?

• An influential administrative assistant.

What

Why

• The new hire sitting at the front entrance.
• Expert third-party contractors visiting for the day.

Even if these personnel do not officially have direct access to private

Specific types of attacks, and how to

The critical role each employee plays,

recognize and repel them.

no matter their title, role or location.

information or storage, bad security habits born of convenience— and proximity to high-value targets — offer easy access to anagency’s most sensitive information and material.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

20

Next Steps“Training for all” without a“one size fits all” mindset

1

2

Train ambassadors
Develop highly trained “security ambassadors” — people
who don’t work in security but have an interest in it.

Pay special attention for
high-risk employees
Identify your high-risk segments and develop a custom
curriculum for each one — focusing on realistic scenarios
for a given government agency based on recent threats.

3

Make it positive
Make training events memorable. Lecture-style training
has a place, but also consider competitive activities or“gamified” scenario planning.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

21

04

Futureproofing Government
Organizations

Problem Today

Legacy systems, techstack complexity, datasilos, talent shortages …
should we go on?
Many assume that governments — big cities, federal agencies,
military agencies or public works — must have cybersecurity
all figured out.

Most commonly reported barriers to
global cybersecurity excellence
Q:

Which of these are significant barriers to cybersecurity
excellence at your organization?

37%

Tech stack complexity

Security skills gap

36%(After all, some of the most advanced cybersecurity talent andtechnology reside in military departments and applications!)
In reality, most governmental organizations lack sustainablefunding to invest in:

Insufficient cybersecurity
tech/systems

33%

Ineffective/incomplete
employee training

32%• Talent
Over-reliance on
trust/people• New technology• Training

30%

Insufficient cybersecurity
budget• Culture29%

Lack of leadershipengagement/buy-in

21%

Insights from Press Reset: A 2023 Cybersecurity Status Report

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government23

Why It MattersThreat actors
continue to advancetheir weapons against
old defenses

Security threats versus security preparedness
High + Critical Threat!

“Very Prepared”

Inverted Threat

Phishing

According to a report from the US Government

Ransomware!!

Software vulnerabilities!!

Accountability Office (GAO), the US federal
government still has not implemented more than halfof the recommendations from the GAO since 2010.8
DDoS attack

Q:

Please rate the predicted 2023
threat level within your industry foreach of the following …

!

API-related vulnerabilities

Compromised credentials

Q:!

Supply chain

How prepared is your organization
to deal with each type of threat
listed here?

Poor encryption
Malicious employees
30%

40%

50%

60%

70%

Insights from Press Reset: A 2023 Cybersecurity Status Report

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

24

Real-World Repercussions:Public sector remains exposed tostate-sponsored hackers
The public sector is particularly vulnerable to attacks from statesponsored cybercriminals, who will move against any related(no matter how distant) agency.

Select advanced persistent threats (APTs) andcyber gangs attacking global governments include:

ALPHV
A cybercriminal gang responsible for creating, selling,
and deploying a “ransomware as a service” model,
or RaaS. Off-the-shelf hacking solutions like theseempower a wide range of threat actors.

For more context on other active threat actors beyond the three
featured to the right – as well as their methodologies, exploitedvulnerabilities and publicly known government attacks – please readthe complete 2023 Cyberstrategy Tool Kit.

APT29
State-sponsored hackers connected to Russia’sforeign intelligence service dedicated to espionage“Our energy, healthcare and financial
systems [...] all face cyber risks frommalicious actors. Attacks like these
could cause serious harm to people, ourenvironment, national security and mostimportantly our economy.”⁸and intelligence activities.

Conti
A Russian-associated threat actor that dissolved
after its playbook was leaked — but Conti-affiliatedhackers and code are now rogue threats. Conti-style

Marisol Cruz Cain
Director, GAO Information Technology and Cybersecurity Teamransomware tactics were still evident in multiple
cybercriminal gangs in the last year.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

25

Take Action

Battle misinformation
and accelerated attacks
through strategic
technology and culture

We live in a world where
misinformation is power:

All of these can wreak havoc on public safety, global commerce and diplomacy —and even cost lives. Government organizations are particularly vulnerable, because
they hold the keys to systems and messages that bad actors want to disrupt andexploit.

Bot-powered social media misinformation campaigns at scale

Security leaders must protect their positions by operating with precision: developing
strategies, systems, tools, training and governance that work in concert to keep out
bad actors.

Highly believable phishing attacks, tuned to individual preferences

And it’s critical to build out these defenses in comparative “peacetime” too manyorganizations take critical steps after a catastrophic attack.

Deepfakes that undermine independent journalism and disrupt elections

The time to act is now.

Ransomware that interrupts global logistics and healthcare delivery

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

26

Next Steps

Futureproof your tech stacks

1

2

3

4

Resilience

Automation

Empowerment

Design react-and-recover plans

Deploy automation to boost

Give the cybersecurity team more

to shorten outages and limit

asset visibility and deploy a risk-

independence and budget to set

knock-on effects.

based prioritization to patching

the security agenda — no more

— both table stakes for secure

thoughtless reactions to the latest

organizations in 2023.

threat to hit the news.

Holistic risk
management
Think about security beyond
government walls — from workfrom-everywhere (WFE) and hybrid
employees, to third-party contractors
and vendors.

The scale and urgency of the situation requires government organizations
to approach cybersecurity as a team effort – and augment that effort withtechnology that doesn’t place additional burden on workers.
The security posture of governments and agencies will be strengthened
when cybersecurity is an issue all employees understand, care about and feel

For more information:accountable to – coupled with proactive security measures that enable a better

Press Reset: A 2023 Cybersecurity Status Report

employee experience.

Government Cybersecurity Status Report

No Culture of Accountability

Password (Mis)management

Training for All

Futureproofing Government

27

References
1. Partnership for Public Service: “Engaging employees at federal agencies,”
July 14, 2022. https://ourpublicservice.org/blog/engaging-employees-atfederal-agencies/
2. Ivanti: “2023 Cyberstrategy Tool Kit for Internal Buy-in.” October 2022.
https://www.ivanti.com/resources/v/doc/ebooks/ivi-2702-cybersecurity-toolkit-internal-buy-in-budget-influence-non-infosec
3. Sharon Ben-Moshe, Gil Gekker, Golan Cohen / Check Point Research:“OPWNAI: AI That Can Save the Day or Hack It Away.” Dec. 19, 2022. https://
research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hackit-away/
4. VOA: “Research: Deepfake ‘News Anchors’ in Pro-China Footage.” Feb. 8,2023. https://www.voanews.com/a/research-deepfake-news-anchors-in-prochina-footage/6953588.html
5. U.S. Government Accountability Office: “Cybersecurity High-Risk Series:
Challenges in Protecting Privacy and Sensitive Data,” Feb. 14, 2023. https://www.gao.gov/products/gao-23-106443
6. Partnership for Public Service: “Employee Engagement,” July 13, 2022.
https://ourpublicservice.org/our-solutions/employee-engagement/
Federal News Network: “Return-to-office plans a major cause for decline in
2021 Best Places to Work results,” July 13, 2022. https://federalnewsnetwork.
com/workforce/2022/07/return-to-office-plans-a-major-cause-for-declinein-2021-best-places-to-work-results/
7. Ivanti: “2023 Cyberstrategy Tool Kit for Internal Buy-in.” October 2022.
https://www.ivanti.com/resources/v/doc/ebooks/ivi-2702-cybersecurity-toolkit-internal-buy-in-budget-influence-non-infosec
8. U.S. Government Accountability Office: “Cybersecurity High-Risk Series:
Challenges in Establishing a Comprehensive Cybersecurity Strategy and
Performing Effective Oversight,” Jan. 19, 2023. https://www.gao.gov/assets/
gao-23-106415.pdf

Government Cybersecurity Status Report28Government Cybersecurity
Status Report

ivanti.com

4 Important Ways to Take Action and Drive Change in 2023

sales@ivanti.com

1 800 982 2130

Copyright © 2023, Ivanti. All rights reserved. IVI-2747 ARS/KF